One-way quantum key distribution: Simple upper bound on the secret key rate 
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We present a simple metliod to obtain an upper bound on the achievable secret key rate in 
quantum key distribution (QKD) protocols that use only unidirectional classical communication 
during the public-discussion phase. This method is based on a necessary precondition for one- 
way secret key distillation; the legitimate users need to prove that there exists no quantum state 
having a symmetric extension that is compatible with the available measurements results. The main 
advantage of the obtained upper bound is that it can be formulated as a semidefinite program, which 
can be efficiently solved. We illustrate our results by analyzing two well-known qubit-based QKD 
protocols: the four-state protocol and the six-state protocol. Recent results by Renner et al. [1] 
also show that the given precondition is only necessary but not sufficient for unidirectional secret 
key distillation. 
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I. INTRODUCTION 

Quantum key distribution (QKD) [2, 3] allows two par- 
ties (Alice and Bob) to generate a secret key despite the 
computational and technological power of an eavesdrop- 
per (Eve) who interferes with the signals. This secret key 
is the essential ingredient of the one-time-pad or Vernam 
cipher [4] , which can provide information-theoretic secure 
communications. 

Practical QKD protocols distinguish two phases in or- 
der to generate a secret key: a quantum phase and a clas- 
sical phase. In the quantum phase a physical apparatus 
generates classical data for Alice and Bob distributed ac- 
cording to a joint probability distribution p{ai, bj) = pij. 
In the classical phase, Alice and Bob try to distill a se- 
cret key from pij by means of a public discussion over an 
authenticated classical channel. 

Two types of QKD schemes are used to create the cor- 
related data Pij. In entanglement based (EB) schemes, 
a source, which is assumed to be under Eve's control, 
produces a bipartite quantum state pab that is dis- 
tributed to Alice and Bob. Eve could even have a 
third system entangled with those given to the legiti- 
mate users. Alice and Bob measure each incoming sig- 
nal by means of two positive operator valued measures 
(POVM) [5] {Ai} and {Bj}, respectively, and they ob- 
tain Pij = Tr{Ai (g) Bj pab)- 

In an ideal prepare and measure (PM) schemes, Alice 
prepares a pure state \ipi) with probability pi and sends 
it to Bob. On the receiving side. Bob measures each 
received signal with a POVM {Bj}. The signal prepa- 
ration process in PM schemes can be also thought of 
as follows [6]: First, Alice produces the bipartite state 
l-ipsource) AB = Z]i V^l"^) A I V'i) B ^ud, aftcrwards, she 
measures the first subsystem in the orthogonal basis 
|aj)^ corresponding to the measurements Ai = |Q!i)^(Q;i|. 
This action generates the (non-orthogonal) signal states 



\ipi) with probabilities pi. In PM schemes the reduced 
density matrix of Alice, pA = TrB{\ipsource) ABi^'sourcel), 
is fixed and cannot be modified by Eve. To include this 
information in the measurement process one can add to 
the observables {Ai(^ Bj}, measured by Alice and Bob, 
other observables {Ck ^ 1} such that they form a tomo- 
graphic complete set of Alice's Hilbert space [7, 8]. In 
the most general PM scheme Alice is free to prepare ar- 
bitrary states Pi instead of only pure states \(fi). One can 
apply the same framework as for the ideal PM scheme, 
as reviewed in App. A. 

From now on, we will consider that pij and {A^ ® Bj} 
refer always to the complete set of measurements, i.e., 
they include also the observables {Ck 'S) 1} for PM 
schemes. 

The public discussion performed by Alice and Bob dur- 
ing the classical phase of QKD can involve either one-way 
or two-way classical communication. Two-way classical 
communication is more robust than one-way in terms of 
the amount of errors that the QKD protocol can toler- 
ate in order to distill a secret key [9]. However, the first 
security proof of QKD by Mayers [10], and the most com- 
monly known proof by Shor and Presskill [11] are based 
on one-way communications, and many other security 
proofs of QKD belong also to this last paradigm [12, 13]. 
Moreover, any two-way communication protocol includes 
a final non-trivial step that is necessarily only one-way, 
so that the study of one-way communication is also useful 
for the study of two-way communication. 

In this paper we concentrate on one-way classical com- 
munication protocols during the public discussion phase. 
Typically, these schemes consist of three steps: local pre- 
processing of the data, information reconciliation to cor- 
rect the data, and privacy amplification to decouple the 
data from Eve [14]. Depending on the allowed direc- 
tion of communication, two different cases must be con- 
sidered. Direct communication refers to communication 
from Alice to Bob, reverse reconciliation allows com- 
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munication from Bob to Alice only. (See, for instance, 
[15, 16].) We will consider only the case of direct com- 
munication. Expressions for the opposite scenario, i.e., 
reverse reconciliation, can be directly obtained simply 
by renaming Alice and Bob. Note that for typical ex- 
periments, the joint probability distribution pij is not 
symmetric, so that the qualitative statements for both 
cases will differ. 

We address the question of how much secret key can be 
obtained from the knowledge oipij and {Ai ® Bj}. This 
is one of the most important figures of merit in order to 
compare the performance of different QKD schemes. Wc 
consider the so-called trusted device scenario, where Eve 
cannot modify the actual detection devices employed by 
Alice and Bob. (See Refs. [8, 17].) We assume that the 
legitimate users have complete knowledge about their de- 
tection devices, which are fixed by the actual experiment. 

In the last years, several lower and upper bounds on 
the secret key rate for particular one-way QKD schemes 
have been proposed. The lower bounds come from proto- 
cols that have been proven to be secure [1, 11-13, 18, 19]. 
The upper bounds are generally derived by considering 
some particular eavesdropping attack and by determin- 
ing when this attack can defeat QKD [1, 19-22]. Un- 
fortunately, to evaluate these known bounds for general 
QKD protocols is not always a trivial task. Typically, it 
demands to solve difficult optimization problems, which 
can be done only for some particular QKD protocols [1] . 

In this paper we present a simple method to obtain an 
upper bound on the secret key rate for general one-way 
QKD protocols. The obtained upper bound will not be 
tight for all QKD schemes, but it has the advantage that 
it is straightforward to evaluate in general since it can be 
formulated as a semidefinite program [23, 24]. Such in- 
stances of convex optimization problems can be efficiently 
solved, for example by means of interior-point methods 
[23, 24]. Our analysis is based on a necessary precondi- 
tion for one-way QKD: The legitimate users need to prove 
that there exists no quantum state having a symmetric 
extension that is compatible with the available measure- 
ment results [25]. This kind of states (with symmetric 
extensions) have been recently analyzed in Refs. [26-28]. 

The paper is organized as follows. In Sec. II we re- 
view some known upper bounds on the secret key rate 
using one-way post-processing techniques. Sec. Ill in- 
cludes the main result of the paper. Here we introduce a 
straightforward method to obtain an upper bound on the 
secret key rate for one-way QKD. This result is then il- 
lustrated in Sec. IV for two well-known qubit-based QKD 
protocols: the four-state [3] and the six-state [29] QKD 
schemes. We select these two particular QKD schemes 
because they allow us to compare our results with already 
known upper bounds in the literature [1, 19-22]. Then 
in Sec. V wc present our conclusions. The paper includes 
also two Appendices. In App. A we consider very briefly 
the case of QKD based on mixed signal states instead 
of pure states. Finally, App. B contains the semidefi- 
nite program needed to actually solve the upper bound 



derived in Sec. III. 



II. KNOWN UPPER BOUNDS 

Different upper bounds on the secret key rate for one- 
way QKD have been proposed in the last years. These 
results either apply to a specific QKD protocol [20-22], 
or they are derived for different starting scenarios of the 
QKD scheme [1, 18, 19], e.g., one where Alice and Bob 
are still free to design suitable measurements. 

Once Alice and Bob have performed their measure- 
ments during the quantum phase of the protocol, they 
are left with two classical random variables A and B, 
respectively, satisfying an observed joint probability dis- 
tribution p(ai,bj) = pij. On the other hand. Eve can 
keep her quantum state untouched and delay her mea- 
surement until the public-discussion phase, realized by 
Alice and Bob, has finished. 

In order to provide an upper bound on the secret key 
rate it is sufficient to consider a particular eavesdropping 
strategy. For instance, we can restrict ourselves to col- 
lective attacks [1, 19]. This situation can be modelled by 
assuming that Alice, Bob, and Eve share an unlimited 
number of the so-called ccq states pccg which are given 
by [18] 

Pccq = Y^Pij \ij)AB{ij\ Pe ' (1) 

where p'^ denotes Eve's conditional quantum state, and 
the states {JOa) ^'^'^ {b)^} form orthonormal basis sets 
for Alice and Bob, respectively. As shown in Refs. [1, 19], 
in this scenario the rate , at which Alice and Bob can 
generate a secret key by using only direct communication, 
is bounded from above by 

< sup S{U\ET) - S{U\BT), (2) 

0-(7<— A 
crT<—A 

where the supremum is taken over all possible density 
operators ajj and ot depending on the random variable 
A of Alice. The von Neumann entropy of a quantum state 
p reads as S{p) = —Tr{p log p), while the conditional von 
Neumann entropy S is defined in terms of von Neumann 
entropies itself, i.e., S{U\ET) = S{UET) - S{ET). The 
upper bound given by Eq. (2) refers to the quantum state 
given by Eq. (1) after a local post-processing step. It is 
given by [1, 19] 

PUTBE = XI Pv C^h^f^T® \j) B{j\®PE, (3) 

where = Y^jP{^j\o-i)p^E ■ This upper bound involves 
only a single letter optimization problem. However, 
the optimization runs over density operators au and gt 
which makes Eq. (2) hard to evaluate. 

Another upper bound that applies to the QKD scenario 
that we consider here is the Csiszar and Korner's secret 
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key rate for the one-way classical key-agreement scenario 
[30]. Suppose that Ahcc, Bob, and Eve have access to 
many independent reahzations of three random variables 
A, B, and E, respectively, that are distributed according 
to the joint probability distribution p{ai, bj, efe). Csiszar 
and Korner showed that the one-way secret key rate is 
given by [30] 

S^{A; B\E) = sup H{U\ET) - H{U\BT). (4) 

T*-U 

The single letter optimization ranges over two clas- 
sical channels characterized by the transition proba- 
bilities Q{ui\ai) and and where the con- 
ditional Shannon entropy is defined as H(U\ET) = 
-Y^p{ui,ek,tm)'^ogp{ui\ek,tm)- The first channel pro- 
duces the secret key [/, while the second channel creates 
the broadcasted information T. 

Note that Eq. (4) provides also an upper bound on K^. 
Eve can always measure her subsystem of the ccq state 
given by Eq. (1) by means of a POVM {Ek\- As a result, 
Alice, Bob, and Eve share the tripartite probability dis- 
tribution p(ai, 6j, e^) = Pij Tr{Ekp'^). Unfortunately, 
the optimization problem that one has to solve in order 
to obtain S^{A; B\E) is also non-trivial, and its solution 
is only known for particular examples. (See Ref. [31].) 

Finally, an easy computable upper bound on 
is given by the classical mutual information I{A] B) 
between Alice and Bob [32]. This quantity is de- 
fined in terms of the Shannon entropy H[A) = 
— ^p(ai) logp(ai) and the Shannon joint entropy 
H{A,B) = - Y,p{ai,bj)\ogp{ai,bj) as 

I{A-B)=H{A) + H{B)- H{A,B). (5) 

The mutual information represents an upper bound on 
the secret key rate for arbitrary public communication 
protocols, hence in particular for one-way communication 
protocols [32], i.e., 

K^<S^{A-B\E)<I{A-B). (6) 

To evaluate I{A] B) for the case of QKD, we only need 
to use as p{ai, bj) the correlated data pij. 

III. UPPER BOUND ON 

Our starting point is again the observed joint probabil- 
ity distribution pij obtained by Alice and Bob after their 
measurements. This probability distribution defines an 
equivalence class <S of quantum states that are compati- 
ble with it, 

S = {pAB I Tr{A^ (g) Bj pab) = Vi,i} . (7) 

By definition, every state pab G S can represent the state 
shared by Alice and Bob before their measurements [47] . 

Now the idea is simple: just impose some particular 
eavesdropping strategy for Eve, and then use one of the 



already known upper bounds. (See also Ref. [33].) The 
upper bound resulting represents an upper bound for any 
possible eavesdropping strategy. The method can be de- 
scribed with the following three steps. 

(1) Select a particular eavesdropping strategy for Eve. 
This strategy is given by the choice of a tripartite quan- 
tum state pabe and a POVM {Ek} to measure Eve's sig- 
nals. The only restriction here is that the chosen strategy 
cannot alter the observed data, i.e., TrE{pABE) € S. 

(2) Calculate the joint probability distribution piji^ = 
Tr{Ai Bj O Ek pabe)- 

(3) Use an upper bound for given the probability 
distribution pijk- Here we can use, for instance, Eq. (4) 
or just the mutual information between Alice and Bob 
which is straightforward to calculate. 

This method can be improved by performing an opti- 
mization over all possible measurements on Eve's system 
and over all possible tripartite states that Eve can ac- 
cess [48] . This gives rise to a set of possible extensions V 
of the observed bipartite probability distribution pij for 
the random variables A and B to & tripartite probability 
distribution p^fe for the random variables A, B, and E. 
Now the upper bound is given by 

K^<miS^, (8) 

with representing the chosen quantity in step (3). 

In Sec. Ill A we present a necessary precondition for 
one-way QKD. In particular, Alice and Bob need to prove 
that there exists no quantum state having a symmetric 
extension that is compatible with the available measure- 
ments results [25] . Motivated by this necessary precondi- 
tion, we introduce a special class of eavesdropping strate- 
gies for Eve in Sec. IIIB. These strategies are based on a 
decomposition of quantum states similar to the best sep- 
arability approximation [34, 35], but now for states with 
symmetric extensions. The general idea followed here is 
similar to that presented in Ref. [33] for two-way upper 
bounds on QKD. 

A. States With Symmetric Extensions & One- Way 

QKD 

A quantum state pab is said to have a symmetric ex- 
tension to two copies of system B if and only if there 
exists a tripartite state pabb' with Hb = 'Hb' which 
fulfills the following two properties [26]: 

TrB'(pABB') = pAB, (9) 
PPABB'P = PABB', (10) 

where the operator P satisfies P\ijk) j^^^, = \ikj)j^^g,. 
This definition can be easily extended to cover also the 

case of symmetric extensions of pab to two copies of sys- 
tem A, and also of extensions of pab to more than two 
copies of system A or of system B. 

States with symmetric extension play an important 
role in quantum information theory, as noted recently. 



4 



They can deliver a complete family of separability cri- 
teria for the bipartite [26, 27] and for the multipartite 
case [28] , and they provide a constructive way to create 
local hidden variable theories for quantum states [36]. 
Moreover, they are related to the capacity of quantum 
channc;ls [37]. Most important, a connection to one-way 
QKD has also been noticed: 

Observation 1 [25]: If the observed data originate 
from a quantum state pab which has a symmetric exten- 
sion to two copies of system B, then the secret key rate 
for unidirectional communication from Alice to Bob 
vanishes. 

Proof: Suppose that the observed data pij originate 
from a state pab which has a symmetric extension to 
two copies of system B. Suppose as well that the third 
subsystem of the extended tripartite state pabb' is in 
Eve's hands, i.e., pabe = Pabb'- This results in equal 
marginal states for Alice-Bob and Alice- Eve, i.e., pab = 
Pae- Prom Alice's perspective the secret key distillation 
task is then completely symmetric under interchanging 
Bob and Eve. Since we restrict ourselves to unidirectional 
classical communication from Alice to Bob only, we find 
that it is impossible for Bob to break this symmetry. 
That is, if Alice tries to generate a secret key with Bob 
her actions would automatically create exactly the same 
secret key with Eve. To complete the proof we need to 
verify that Eve can access the symmetric extension Pabb' 
of Pab in both kinds of QKD schemes, EB schemes and 
PM schemes. It was demonstrated in Ref. [7] that Eve 
can always create a purification of the original state pab , 
which means that Eve can have access to the symmetric 
extension. ■ 

Remark 1: A quantum state pab has a symmetric ex- 
tension to two copies of system B if and only if there 
exists a tripartite state pabe with equal marginal states 
for Ahce-Bob and Alice-Eve, i.e., pab = Pae- 

Proof: If a quantum state pab has a symmetric exten- 
sion this automatically implies equal marginal states for 
Alice-Bob and Alice-Eve. For the other direction, sup- 
pose that there exists a tripartite state Pabe with equal 
marginals, but which is not symmetric under interchange 
of subsystems B and E. Then the state PpabeP is also 
a possible tripartite state with equal marginals. This al- 
lows to construct the symmetric extension of the state 
Pab as pabe = 1/2{pabe + PpabeP)- ■ 

There exists entangled states which do have symmetric 
extensions [26, 27]. Hence, accordingly to Observation 1, 
although these states are entangled and therefore poten- 
tially useful for two-way QKD [7], they are nevertheless 
useless for one-way QKD in the corresponding direction. 

We define the best extendibility approximation of a 
given state pab as the decomposition of pab into a state 
with symmetric extension, that we denote as (Text, and a 
state without symmetric extension pn^, while maximizing 
the weight of the extendible part agxt [49], i.e., 

Pab = raaxXaext + (1 - A)/9„e- (H) 
This definition follows the same spirit as the best separa- 



bility approximation introduced in Refs. [34, 35]. Since 
the set of all extendible quantum states forms a closed 
and convex set [27], the maximum in Eq. (11) always ex- 
ists. We denote the maximum weight of extendibility of 
PAB as XmaxiPAB), where < XmaxiPAB) < 1 is satis- 
fied. 

Given an equivalence class <S of quantum states, we 
define the maximum weight of extendibility within the 
equivalence class, denoted as A^^^., as 

>^max = raax {XmaxiPAB) \ pAB € S} . (12) 

This parameter is related to the necessary precondition 
for one-way secret key distillation by the following obser- 
vation. 

Observation, 2: Assume that Alice and Bob can per- 
form local measurements with POVM elements Ai and 
Bj , respectively, to obtain the joint probability distribu- 
tion of the outcomes pij on the distributed quantum state 
Pab- Then the following two statements are equivalent: 
(1) The correlations Pij can originate from an extendible 
state. (2) The maximum weight of extendibility A^^^. 
within the equivalence class of quantum states S com- 
patible with the observed data pij satisfies Aj^j^^j, = 1. 

Proof. If Pij can originate from an extendible state, 
then there exists a aext such as aext € >5. Moreover, we 
have that any extendible state satisfies Xmaxif^sep) = 1- 
The other direction is trivial. I 

Let us define Smax as the equivalence class of quan- 
tum states composed of those states pab & S that have 
maximum weight of extendibility. It is given by 

^max = {pab e S I XmaxiPAB) = A^^^, } . (13) 

B. Eavesdropping Model 

An eavesdropping strategy for our purpose is com- 
pletely characterized by selecting the overall tripar- 
tite quantum state pabe and the measurement oper- 
ators {-E/c}. Again, the only restriction here is that 
TrsipABE) € S. We consider that Eve chooses a pu- 
rification Pabe = |^)ab_e(^I ^ state pab taken from 
the equivalence class Smax- 

The quantum states Uext and pne of the best extendibil- 
ity approximation of pab can be written in terms of their 
spectral decomposition as [50] 

(Text = '^(li\<l>i)ABi'i^i\' (14) 

i 

Pne = ^Pi\i^i)AB{i^il (15) 

i 

with = {tpi\fpj) = for all i 7^ j. A possible 

purification of the state pab is given by 

\^)aBE = \l ^fnax'l^\'t>t) AB\ik = ext, /^)^ + 
i 

X] \/(l ~ ^tax)Pj\'^j) ABl'tk = ne, fj)j^, (16) 

j 
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where the states {\tk = ext, fi), \tk = ne, fj)} form an or- 
thogonal bases on Eve's subsystem. 

It is important to note that in both kinds of QKD 
schemes, EB schemes and PM schemes, Eve can always 
have access to the state l^)^^^; given by Eq. (16). This 
has been shown in Ref. [7]. In an EB scheme this is 
clear since Eve is the one who prepares the state pab 
and who distributes it to Alice and Bob. In the case of 
PM schemes we need to show additionally that Eve can 
obtain the state 1^)^^^ by interaction with Bob's sys- 
tem only. In the Schmidt decomposition the state pre- 
pared by Alice, \ipsource) ab, can be written as \ipsource) = 
'^iCi\ui)A\vi)B- Then the Schmidt decomposition of 
\^}abe^ "^it^ respect to system A and the composite sys- 
tem BE, is of the form l*)^^^; = Ci\ui)A\ei) be since 
Cj and \ui)A are fixed by the known reduced density ma- 
trix Pa to the corresponding values of \ij->source)AB- Then 
one can find a suitable unitary operator Ube such that 
\^i)BE = UBE\vi)B\^)E where \Q)e is an initial state of 
an auxiliary system. 

For simplicity, we consider a special class of measure- 
ment strategies for Eve. This class of measurements can 
be thought of as a two step procedure: 

(1) First, Eve distinguishes contributions com- 
ing from the part with symmetric extension and 
from the part without symmetric extension of 
Pab- The corresponding measurements are pro- 
jections of Eve's subsystem onto the orthogonal 
subspaces Tle^t = Y.i\tk = ext, fi){tk = ext, fi\ and 
n„e = J2j \tk = ne, fj}{tk = ne, fj\. 

(2) Afterwards, Eve performs a refined measurement 
strategy on each subspace separately. As we will see, 
only the non-extendible part Pne might allow Alice and 
Bob to distill a secret key by direct communication; from 
the extendible part no secret key can be obtained. 

We shall label Eve's measurement outcomes Cfe with 
two variables, Ck = {tk,.fk)- The first variable tk € 
{ext, ne} denotes the outcome of the projection measure- 
ment, while fk corresponds to the outcome arising from 
the second step of the measurement strategy. With prob- 
ability p{tk = ne) = 1 — A^^^, Eve finds that Alice and 
Bob share the non-extendible part of pab ■ After this first 
measurement step, the conditional quantum state shared 
by Alice, Bob, and Eve, denoted as Pa^qe — \^ne){^ne\, 
corresponds to a purification of pne, i-e., 

\^ne)ABE ^ Yl VPjI^j) ABl^k = ne, fj) j^. (17) 
3 

Next we provide an upper bound for that arises 
from this special eavesdropping strategy. Moreover, as 
we will see, the obtained upper bound is straightforward 
to calculate. 



C. Resulting Upper Bound 

For the special eavesdropping strategy considered in 
Sec. IIIB, we will show that we can restrict ourselves to 



the non-extendible part pne of a given pab only. As a 
consequence, the resulting upper bound will only depend 
on this non-extendible part. This motivates the defini- 
tion of a new equivalence class of quantum states S^^^^, 
defined as 

^max = {PneiPAB) \ PAB S Smax} , (18) 

where PneiPAs) represents the non-extendible part in a 
valid best extendibility approximation of pab G Smax 
given by Eq. (11). To simplify the notation, from now 
on we will write pne instead of pneiPAs)- The possibility 
to concentrate on the non-extendible parts only is given 
by the following theorem. 

Theorem 1: Suppose Alice's and Bob's systems are 
subjected to measurements described by the POVMs 
{Ai\ and {Bj} respectively, and their outcomes follow 
the probability distribution pij . They try to distill a se- 
cret key by unidirectional classical communication from 
Alice to Bob only. The secret key rate, denoted as K^, 
is bounded from above by 

< (1 - ALjinf 5^(A;i?|£;), (19) 

V* 

where S^{A; B\E) denotes the classical one-way secret 
key rate given by Eq. (4) for a tripartite probability dis- 
tribution pijk e V*. The set V* considers all possible 
POVMs {Ek} which Eve can perform on a purification 
\'^ne) ABE nou- extendible part pne S SJ^g^^ only. 

I.e., Pijk — 

Tr[Ai Bj Ek{\^ne) ABE{^ne\)]- 

Proof: In order to derive Eq. (19) we have considered 
only a particular class of eavesdropping strategics for Eve 
as described in Sec. IIIB. This class defines a subset V 
of the set of all possible extensions V of the observed 
data Pij to a general tripartite probability distribution 
Pijk, which are considered in the upper bound given by 
Eq. (8). We have, therefore, that 

< i^S^{A;B\E) < ini S^{A;B\E). (20) 

As introduced in Sec. IIIB, we label the outcome 

of Eve's measurement strategy by two variables = 
{fk,tk), where the value of tk G {ext,ne} labels the out- 
come of her projection measurement. For the tripartite 
probability distribution p{ai,bj,ek = {fk,tk)) we denote 
the secret key rate by S^{A; B\FT). 

For the one-way secret key rate S^{A; B\FT) we get 

S^{A;B\FT) = sup H{U\VFT) - H{U\VB) 

U^A 

< sup H{U\VFT) - H{U\VBT) 

U-^A 

< sup H{U\VFT)- H{U\VBT). (21) 

U^AT 

In the first line we just use the definition of the classi- 
cal secret key rate given by Eq. (4). The first inequality 
comes from the fact that conditioning can only decrease 
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the entropy, i.e., H{U\VB) > H{U\VBT). For the last 
inequality, we give Alice also access to the random vari- 
able T, additionally to her variable A, over which she 
can perform the post-processing. Altogether Eq. (21) 
tells that if Eve announces publicly the value of the vari- 
able T, so whether Alice and Bob share the extendible 
or non-extendible part, that this action can only enhance 
Alice and Bob's ability to create a secret key. 
Next, we have that 

sup H{U\VFT)-H{U\VBT) 

U^AT 

= sup y^p{tk){H{U\VFtk) - H{U\VBtk)] 
= y^p{tk) sup {H{U\VFtk) - H{U\VBtk)] 

^ U^Atk 
V*-U 

= ^p{h)S'_XiA;B\F). (22) 

First we rewrite the conditional entropies in terms of 
an expectation value over the parameter tk- The map 

U ^ AT acts independent on each term of the sum over 
tk ■ Therefore the supremum can be put into the sum tak- 
ing the specific value of tk- Since sup^^J^^^ is equal to 
sup[;^^ for tk fixed, we find on the right hand side the 
one-way secret key rate for the conditional three party 
correlation p{ai, bj,fi\tk) denoted as S'^{A; B\F). 
Combining Eqs. (21,22) we have, therefore, that 

S^{A;B\FT) < Y,p{tk)S^{A-B\F-T = tk). (23) 

From Observation 1 we learn that Alice and Bob can- 
not draw a secret key out of the extendible part a^xt, 
i.e., S^{A;B\E;tk = ext) = 0. Therefore, only the 
non-extendible part pne can contribute to a positive se- 
cret key rate. The conditional probability distribution 
p{ai, bj, fk\tk = ne) = pijk defines exactly the considered 
extensions V*. This concludes the proof. ■ 

The upper bound given by Eq. (19) requires to solve 
the infimum over all possible extensions V*. Instead of 
this optimization, one can just pick a particular state 
^max ^^'^ calculate the infimum over all possible mea- 
surements {Ek} employed by Eve. 

Corollary 1: Given a state pne & ^max^ the secret key 
rate is bounded from above by 

i^^ < (1 - Ai„ J inf S^^ {A; B\E), (24) 

with S^{A;B\E) being the classical one-way secret key 
rate of the tripartite probability distribution pijk = 
Tr{Ai®Bj®Ek (|$„e)(*ne|)), and where |i>„e) denotes 
a purification of Pne- 

Proof: The right hand side of Eq. (24) is an upper 
bound of the right hand side of Eq. (19), because in Eq. 
(24) we take only a particular state pne € S^^^^, whereas 
in Eq. (19) we perform the infimum over all possible 
states Pne e S"^^^. ■ 



The upper bounds provided by Theorem 1 and Corol- 
lary 1 still demand solving a difficult optimization prob- 
lem. Next, we present a simple upper bound on 
that is straightforward to calculate. Then, in Sec. IV, 
we illustrate the performance of this upper bound for 
two well-known QKD protocols: the four-state [3] and 
the six-state [29] QKD schemes. We compare our results 
to other well-known upper bounds on for these two 
QKD schemes [1, 19 22]. 

Corollary 2: The secret key rate is upper bounded 

by 

K^<{l-Xi,,)I-%A;B), (25) 

where /'"^(A; B) denotes the classical mutual information 
calculated on the probability distribution pij = Tr{Ai (g) 

Bj Pne) with Pne G S^^,^. 

Proof: According to Eq. (6), the one-way secret key 
rate S^{A; B\E) is bounded from above by the mutual 
information I{A;B). Note that the mutual information 
I{A;B) is an upper bound on the secret key rate for 
arbitrary communication protocols [32]. ■ 

The main difficulty when evaluating the upper bound 
given by Eq. (25) for a particular realization of QKD 
relies on obtaining the parameter A^^^^. and the non- 
extendible state Pne- In App. B we show how this prob- 
lem can be cast as a convex optimization problem known 
as semidefinite program [51]. Such instances of convex 
optimization problems can be efficiently solved, for ex- 
ample by means of interior-point methods [23, 24]. 

IV. EVALUATION 

In this section we evaluate the upper bound on 

given by Eq. (25) for two well-known qubit-based QKD 
protocols: the four-state [3] and the six-state [29] QKD 
schemes. We select these two particular QKD schemes 
because they allow us to compare our results with al- 
ready known upper bounds on [1, 19-22]. Let us 
emphasize, however, that our method can also be used 
straightforwardly to obtain an upper bound for higher di- 
mensional, more complicated QKD protocols, for which 
no upper bounds have been calculated yet. By means of 
semidefinite programming one can easily obtain the max- 
imum weight of extendibility Xf^ax '^^^ the corresponding 
non-extendible part pne which suffice for the computation 
of the upper bound. (See App. B.) 

In the case of the four-state EB protocol, Alice and Bob 
perform projection measurements onto two mutually un- 
biased bases, say the ones given by the eigenvectors of the 
two Pauli operators Gx and cj^ ■ In the corresponding PM 
scheme, Alice can use as well the same set of measure- 
ments but now on a maximally entangled state. Note 
that here we are not using the general approach intro- 
duced previously, \'>i) source) ab = Y.iVPi\^i)A\'^i)B^ 

model PM schemes, since for these two protocols it is suf- 
ficient to consider that the effectively distributed quan- 
tum states consist only of two qubits. For the case of the 
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QBER 

FIG. 1: Upper bound on the one-way secret key rate given 
by Eq. (25) for the four-state (solid) and the six-state (dotted) 
QKD protocols in comparison to known lower bounds on the 
secret key rate given in Rcf. [1]. The equivalence class of states 
S is fixed by the observed data pij, which arc generated via 
measurements onto the state pAs(e) = (1 — 2e) 1^/)^)^^ (-0^1 -|- 
e/2l AB. The quantum bit error rate is given by QBER = e. 
Here we assume an asymmetric basis choice to suppress the 
sifting effect [38]. 



six-state EB protocol, Alice and Bob perform projection 
measurements onto the eigenvectors of the three Pauli 
operators CTx,cry, and CTj on the bipartite qubit states dis- 
tributed by Eve. In the corresponding PM scheme Alice 
prepares the eigenvectors of those operators by perform- 
ing the same measurements on a maximally entangled 
two-qubit state. 

We model the transmission channel as a depolarizing 
channel with error probability e. This defines one pos- 
sible eavesdropping interaction. In particular, the ob- 
served probability distribution pij is obtained in both 
protocols by measuring the quantum state pAsie) = i^ — 
2e)|V'''')^B(V''''| +e/2lAs, where the state \'4'~^)ab repre- 
sents a maximally entangled two-qubit state as |V'^)ab = 
l/\/2(|00)^^ -|- |11)^^), and Iab denotes the identity 
operator. The state PAs(e) provides a probability distri- 
bution Pij that is invariant under interchanging Alice and 
Bob. This means that for this particular example there 
is no difference whether we consider direct communica- 
tion (extension of pAsie) to two copies of system B) or 
reverse reconciliation (extension of pAB{e) to two copies 
of system A). The quantum bit error rate (QBER), i.e., 
the fraction of signals where Alice and Bob's measure- 
ments results differ, is given by QBER = e. 

The resulting upper bounds on are illustrated in 
Fig. 1. These results do not include the sifting factor of 
1/2 for the four-state protocol (1/3 for the six-state pro- 
tocol), since this effect can be avoided by an asymmetric 
basis choice for Alice and Bob [38]. 

Let us consider in more detail the cut-off points for 
K^, i.e., the values of QBER for which the secret key 



rate drops down to zero in Fig. 1. We find that in the 
four-state protocol (six-state protocol) one-way secret 
key distillation might only be possible for a QBER < 
14.6 {QBER < 1/6). These results reproduce the well- 
known upper bounds on both protocols from Refs. [20- 
22]. More recently, a new upper bound for the six-state 
protocol was obtained in Refs. [1, 19], QBER ^ 16.3. 
This result indicates that the upper bound given by Eq. 
(25) is not tight, since it fails to reproduce this last value. 
More importantly, both statements together entail that 
Observation 1 is necessary but not sufficient for one-way 
secret key distillation: there exist bipartite states which 
arc non-cxtendiblc, nevertheless no secret key can be ob- 
tained from them via one-way post-processing. It shows 
that the characterization of useful quantum states for 
one-way QKD is still an open problem. Finally, let us 
mention that the threshold point for the four-state pro- 
tocol computed in Ref. [1, 19] lead to the same cut-off 
point as for the optimal approximate doner attack and 
thus also coincides with the value of our result. 



V. CONCLUSION 

In this paper we address the fundamental question of 
how much secret key can be obtained from the classical 
data that become available once the first phase of QKD is 
completed. In particular, we restrict ourselves to one-way 
public communication protocols between the legitimate 
users. This question has been extensively studied in the 
literature and analytic expressions for upper and lower 
bounds on the one-way secret key rate are already known. 
Unfortunately, to evaluate these expressions for particu- 
lar QKD protocols is, in general, a non-trivial task. It de- 
mands to solve difficult optimization problems for which 
no general solution is known so far. 

Here we provide a simple method to obtain an up- 
per bound on the one-way secret key rate for QKD. It 
is based on a necessary precondition for one-way secret 
key distillation: The legitimate users need to prove that 
there exists no quantum state having a symmetric ex- 
tension that is compatible with the available measure- 
ments results. The main advantage of the method is 
that it is straightforward to calculate, since it can be 
formulated as a semidefinite program. Such instances 
of convex optimization problems can be solved very ef- 
ficiently. More importantly, the method applies both to 
prepare and measure schemes and to entanglement based 
schemes, and it can reproduce most of the already known 
cut-off points for particular QKD protocols. Recent re- 
sults show that the given precondition is only necessary 
but not sufficient, so there exists non-extendible quan- 
tum state which nevertheless are useless for one-way key 
distillation. 
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APPENDIX A: QKD WITH MIXED SIGNAL 
STATES 

In this Appendix wc describe very briefly the case of 
QKD based on mixed quantum states instead of pure 
states. In particular, we analyze PM schemes, since in 
EB schemes it is clear that Eve can always distribute 
mixed states to Alice and Bob, and this situation is al- 
ready contained in the results included in the previous 
sections. More specifically, we translate the necessary 
precondition for secret key generation by unidirectional 
communication to the PM mixed state scenario. 

In the most general PM scheme, Alice prepares mixed 
signal states following a given probability distribu- 
tion Pi and sends them to Bob. Equivalcntly, wc can 
think of the preparation process as follows. Suppose that 
the spectral decomposition of the signal state is given 
t'y = '^j This can be interpreted as 

producing with probability A*- the pure state Alter- 
natively, can as well originate from a pure state in a 
higher dimensional Hilbert space. That is, from a possi- 
ble purification l^i)^/^ of the state pg in the composite 
Hilbert space Ha' which reads as 

j 

Now we can use the same formalism as the one for PM 
schemes based on pure signal states. We can assume that 
first Alice prepares the tripartite quantum state 

\tpsource)AA'B = V^Pi^N) A U> A' l'/'}}^- (^2) 
ij 

Afterwards, in order to produce the actual signal state 
in system Alice performs a measurement onto the 
standard basis of system A only, and completely ignores 
system A'. Her measurement operators are given by 
= The produced signal states are sent to 

Bob who measures them by means of the POVM {Bj}. 
Since Eve can only interact with system B, the reduced 
density matrix of paa' = TrB{\ipsource) AA'sH'sourcel) 
is fixed by the actual preparation scheme. This infor- 
mation can be included in the measurement process by 
adding to the observables measured by Alice and Bob 
other observables {Ck,AA' (8) Is} such that they provide 
complete information on the bipartite Hilbert space of 
Alice Uaa' ='Ha® Ha'- (See also [52].) 



The relevant equivalence class of quantum states 
Saa'b contains all tripartite quantum states paa'b con- 
sistent with the available information during the mea- 
surement process. Obviously, Eve can always access ev- 
ery purification \^ aa'be) of a state in Saa'b- Note that 
the situation is completely equivalent to the case of pure 
signal states [7] . 

Now we are ready to rephrase the necessary precon- 
dition for one-way secret key distillation for the case of 
QKD based on mixed states. For direct communication 
we need to search for symmetric extensions to two copies 
of system B. That is, if we denote with A the bipar- 
tite system on Alice's side A = AA' , we have to search 
for quantum states in the equivalence class Saa' b = ^Ab 
which are extendible to pabb' ■ the case of reverse rec- 
onciliation. Eve needs to possess only a copy of system 
A. Note that the final key is created only from measure- 
ments onto this system. Therefore, in order to determine 
the cut-off points for the key distillation process, one has 
to examine the question whether a four-partite quantum 
state PAA' BE with TrE{pAA'BE) G Saa'b exists such 
that TrA'ipAA'BE) is exactly the desired symmetric ex- 
tension to two copies of system A. 



APPENDIX B: SEMIDEFINITE PROGRAMS 
AND SEARCHING FOR A;^,,^ AND pne 

In this Appendix we provide a method to obtain the 
parameter A^^^, and the corresponding non-extendible 
state Pne- In particular, we show how one can cast 
this problem as a convex optimization problem known 
as semidefinite programming. Such instances of convex 
optimization problems appear frequently in quantum in- 
formation theory and they can be solved very efficiently. 
There are freely- available input tools like, for instance, 
YALMIP [39], and standard semidefinite programming 
solvers, see SeDuMi [40] and SDPT3-3.02 [41]. 

A typical semidefinite problem, also known as primal 
problem, has the following form 

minimise c^x (Bl) 
subject to F(x) = Fq -h ^ XiFi > 0, 

i 

where the vector x = (a;i, ...,xt)'^ represents the objec- 
tive variable, the vector c is fixed by the particular opti- 
mization problem, and the matrices Fq and Fi are Her- 
mitian matrices. The goal is to minimize the linear ob- 
jective function c^x subject to a linear matrix inequality 
constraint F{x) > [23, 24]. (See also Ref. [53].) 

Any bounded Hermitian operator pA = p\ acting on 
a n-dimensional Hilbert space S can be written in terms 
of an operator basis, which we shall denote by {5*^}, sat- 
isfying the following three conditions: Tr{Sj) = nSji, 
Sj = Sj, and Tr{SjSj') = nSjji. A possible choice is 
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given by the SU{n) generators. Using this representa- 
tion, a general bipartite state pab in a (i^s-dimensional 
Hilbert space can be written as 

P^B = J^Y.'-^i^kSF^ (B2) 

kl 

where the coefficients Vki are given by rki = 
Tr{S^SP Pab)- Note that in order to simphcity the nota- 
tion, in this Appendix we omit the tensor product signs 
(g) between the operators. The representation given by 
Eq. (B2) allows us to describe any bipartite density op- 
erator in terms of a fixed number of parameters Vki which 
can serve as the free parameters in the program. 

The knowledge of Ahce and Bob's POVMs {AJ and 
{Bj}, respectively, and the observed probability distri- 
bution pij determines the equivalence class of compati- 
ble states <S. Since every POVM element is a Hermitian 
operator itself, every element can as well be expanded 
in the appropriate operator basis Ai = '^^atmS:^ and 

An arbitrary operator pab = '^/dAB^i'kiS^Sf be- 
longs to the equivalence class S if and only if it fulfils 
the following constraints: In order to guarantee that the 
operator pab represents a valid quantum state, it must 
be normalized Tr{pAB) — ru = 1, and it must be a 
semidefinite positive operator pab > 0. In addition, it 
must reproduce the observed data of Alice and Bob. This 
last requirement imposes the following constraints 

Pr{ai,bj) = '^aikburki=Pij ^ij, (B3) 

kl 

which are linear on the state coefficients Vki- Note that 
every equality constraint Pr{ai,bj) = pij can be repre- 
sented by two inequality constraints as Pr{ai, bj) —pij > 
and —{Pr{ai,bj) — Pij) > 0. 

In order to find the decomposition of a given state 
Pab = '^/dABj2kt'^kiS^SP into an extendible part aext 
and an non-extcndible part p„e, with maximum weight 
^maxipAB) of cxtendibility, we can proceed as follows. 
First we rewrite the problem in terms of unnormalized 
states aext = ^(^ext and pne = (1 - A)p„e as 

pAB = min aext + Pne- (B4) 

Tr{pne) 

Now assume that the unnormalized, extendible state is 
written as agxt = ^/dABj^^kiS^Sj^, which must form 
a semidefinite positive operator aext > 0. In the case of 
direct communication we have to impose that dext has a 



symmetric extension xabb' to two copies of system B. 
That is, XABB' remains invariant under permutation of 
the systems B and B'. This is only possible if the state 
Xabb' can be written as 



XABB' = 




l>m 



+ ^fkiiS^Sl'SP' (B5) 

kl 

with appropriate state coefficients fkim Vfc,VZ > m. 
The extension must as well reproduce the original state 
TrB'ixABB') = ^ext-i which implies that the state coeffi- 
cients of dext and xabb' are related by 

fkii = eu Vfc, /. (B6) 

Hence, some of the state parameters of xabb' are already 
fixed by the coefficients of dext- In addition, the coeffi- 
cients fkim have to form a semidefinite positive operator 

XABB' > 0. 

Once the states pab = T^i'kiSkS^ and the unnormal- 
ized extendible part a^xt = ^^kiS^SP are fixed, the 
remaining non-extendible state pne is determined by the 
decomposition given by Eq. (B4), and equals to 

Pne = PAB - ^^(rfc/ - ekl)S^S^. (B7) 

This operator must be semidefinite positive p„e > 0. 

In total, the state coefficients of the states in the equiv- 
alence class pABi the unnormalized, extendible part in 
the best extendibility decomposition dext and the sym- 
metric extension itself xab b' will constitute the objective 
variables of the SDP program 

^= {rkhhijum)'^- (B8) 

This requires a fixed ordering of the set of coefficients. 
The function to be minimized is the weight on the un- 
normalized, non-extendible part, Tr{pne) = '''ii ~ en. 
Hence the vector c is given by 

c^ = (^,0,--- ,^,0.---), (B9) 

rii eii 

All the semidefinite constraints introduced previously on 
the state coefficients can be collected into a single linear 
matrix inequality constraint given by Eq. (Bl). The 
final -F(x) collects all these constraints as block-matrices 
on the diagonal. 
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